Capstone — Building and Securing a Complete Online Store

WordPress E-Commerce with WooCommerce

Chapter 10 · Capstone — Building and Securing a Complete Online Store

Nine chapters have built the pieces, one at a time. This capstone assembles them into one real, working store — Wick & Ember, a small candle business — from catalog through a hardened, launch-ready checkout, closing this course and the WooCommerce/e-commerce gap WordPress Intermediate/Advanced 10's own honest scope note deliberately left open.

1. Installing WooCommerce & Building the Catalog

WooCommerce is installed and activated the standard plugin way (Chapter 1), and the setup wizard's store details are filled in. The catalog is built from both product types Chapter 2 covered:

Product	Type	Detail
Vanilla Bean, Single Wick	Simple	One price, SKU `WE-VAN-1W`, stock managed with a low-stock threshold of 10
Signature Scent Trio	Variable	Attributes Scent (Vanilla/Cedar/Citrus) × Size (Small/Large) — 6 variations, each with its own SKU/price/stock, per Chapter 2's own parent/`product_variation` child relationship

2. Store Design

The Storefront theme is activated (Chapter 3), and the homepage places a Products block configured to show the store's featured items — the modern equivalent of the [products] shortcode Chapter 3 also covered, chosen here since the homepage is being built in the Block Editor.

3. Verifying the Cart & Checkout Flow

Before connecting real payment, a full test purchase confirms Chapter 4's own order lifecycle end to end: adding items creates only session data in wp_woocommerce_sessions, submitting checkout creates a real order at Pending payment, and — since Wick & Ember sells physical, shippable candles rather than downloads — the order is expected to pass through Processing before reaching Completed, exactly the gap Chapter 4 explained that status exists to represent.

4. Configuring Payment: Stripe in Test Mode

The Stripe gateway plugin is configured with Test mode enabled (Chapter 5) and a full checkout is run using Stripe's own 4242 4242 4242 4242 test card. Chapter 5's own PCI-DSS material is confirmed directly: Stripe's embedded fields tokenize the card before anything reaches Wick & Ember's own server, keeping the store's compliance burden at the lighter SAQ A tier rather than the heavy SAQ D tier a custom card form would require.

5. Shipping & Tax

A single "Domestic" shipping zone is configured with a Flat Rate method, plus a "Heavy" shipping class (Chapter 6) applied to the Signature Scent Trio's larger candles, priced higher than the Standard-class single-wick candle. Tax rates are configured for Wick & Ember's own home state, with a note — per Chapter 6's own honest disclaimer — to confirm actual multi-state nexus obligations with a real accountant before expanding sales significantly beyond that state.

6. Hardening a Custom Order-Lookup Feature

Wick & Ember wants a simple order-status lookup page for customers who checked out as guests, without a My Account login. Built naively, this is exactly Chapter 7's own broken-access-control example — fixed here with an explicit ownership check, alongside escaping and a parameterized query:

<?php function guest_order_lookup() { $order_id = absint( $_GET['order_id'] ); $email = sanitize_email( $_GET['email'] ); $order = wc_get_order( $order_id ); // Chapter 7's own ownership check — the order's billing email must // match the email the requester actually supplied, not just any valid ID if ( ! $order || $order->get_billing_email() !== $email ) { return 'Order not found.'; } // Chapter 7's own escaping — order status came from the database, // but it is still output, so it is still escaped return esc_html( $order->get_status() ); } ?>

Every guest order lookup now requires both a valid order ID and the matching billing email — an attacker guessing sequential order IDs alone can no longer view another customer's order status.

7. A Wholesale Bulk-Discount Hook

A local gift shop wants to buy candles wholesale, 5 or more at a time, at a 10% discount. Chapter 8's own bulk-discount filter is added, unchanged, via a small site-specific plugin rather than the theme's functions.php — guarded, per Chapter 8, against firing outside a real cart context:

<?php add_action( 'woocommerce_before_calculate_totals', 'apply_bulk_discount', 20, 1 ); function apply_bulk_discount( $cart ) { if ( is_admin() && ! defined( 'DOING_AJAX' ) ) { return; } foreach ( $cart->get_cart() as $cart_item ) { if ( $cart_item['quantity'] >= 5 ) { $original_price = $cart_item['data']->get_price(); $cart_item['data']->set_price( $original_price * 0.9 ); } } } ?>

8. Verifying Caching & Core Web Vitals Before Launch

The caching plugin is configured to exclude Cart, Checkout, and My Account entirely, per Chapter 9's own data-leak warning
The mini-cart's Cart Fragments are confirmed working — adding an item from a cached Shop page updates the header's item count without a full page reload
Product photos are confirmed compressed and appropriately sized, addressing Chapter 9's own LCP concern before launch
The Signature Scent Trio's variation-selector area is confirmed to reserve stable space for price/stock text, avoiding the CLS risk Chapter 9 named for Variable products specifically

Only now — switching Stripe out of Test mode

With the catalog built, checkout verified, security hardened, and caching configured correctly, Stripe's Test mode is finally switched off and replaced with live API keys — deliberately the very last step, so nothing still being actively verified could ever accidentally process a real charge.

Chapter Attribution

Piece	Source chapter
WooCommerce as a plugin, not a separate platform; installation	Chapter 1
Simple and Variable products, SKUs, stock management	Chapter 2
Storefront theme, the Products block	Chapter 3
The session-based cart, checkout, and order-status lifecycle	Chapter 4
Tokenized Stripe checkout, Test mode, PCI-DSS scope	Chapter 5
Shipping zones, shipping classes, tax classes, nexus disclaimer	Chapter 6
Ownership-checked, escaped, parameterized order lookup	Chapter 7
The bulk-discount hook, in a site-specific plugin	Chapter 8
Cache exclusions, Cart Fragments, LCP/CLS checks	Chapter 9

Honest Scope Note

What this capstone deliberately doesn't cover

No multi-currency or multi-language support
No marketplace/multi-vendor extensions (a single-seller store only)
No subscriptions or memberships extensions
No headless/REST-API-driven storefront — a traditional, theme-rendered store throughout

Each is a legitimate, genuinely separate future topic — not silently assumed solved here.

Hands-On Exercises

Exercise 1

Explain why the guest order-lookup function checks both the order ID and the billing email, rather than the order ID alone, referencing this capstone's own Chapter 7 material.

📄 View solution

Exercise 2

Explain why this capstone switches Stripe out of Test mode only as the very last step, after every other piece of the store has already been verified.

📄 View solution

Exercise 3

Explain why the Signature Scent Trio (a Variable product) needed a specific Core Web Vitals check in Step 8 that the Vanilla Bean Single Wick (a Simple product) didn't, referencing this course's own Chapter 9 material.

📄 View solution

Chapter 10 Quick Reference — Course & Track Complete

A real store combining WooCommerce's plugin architecture, a mixed product catalog, store design, verified checkout, tokenized payment, shipping/tax, hardened custom code, a real extensibility hook, and a pre-launch performance check
The order-lookup fix is the single most security-sensitive piece — ownership check, then escaped output, then a parameterized query if a raw SQL lookup were ever needed instead
Test mode is switched off only as the final step, deliberately, once everything else is already verified
This closes the WooCommerce/e-commerce gap WordPress Intermediate/Advanced 10's own honest scope note left open, completing the full WordPress track: WordPress Fundamentals (10 ch.), WordPress Intermediate/Advanced (10 ch.), and WordPress E-Commerce with WooCommerce (10 ch.) — 30 chapters in total